CVE-2024-1714 Overview
CVE-2024-1714 affects all supported versions of SailPoint IdentityIQ Lifecycle Manager. The flaw involves how the platform handles entitlement values containing leading or trailing whitespace during an access request initiated by an authenticated user. When such a value is submitted, the request handling logic can produce unintended behavior due to improper input validation ([CWE-20]).
SailPoint IdentityIQ is an identity governance product used to manage user access, entitlements, and lifecycle workflows across enterprise environments. Because the vulnerable component governs access decisions, the issue has implications for authorization integrity within identity workflows.
Critical Impact
An authenticated user submitting an entitlement value with leading or trailing whitespace can trigger improper handling in the access request workflow, affecting confidentiality and access integrity across identity-managed systems.
Affected Products
- SailPoint IdentityIQ 8.1 (base and patches 1–6)
- SailPoint IdentityIQ 8.2 (base and patches 1, 2, 4)
- SailPoint IdentityIQ 8.3 (base and patch 1), and 8.4
Discovery Timeline
- 2024-02-21 - CVE-2024-1714 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1714
Vulnerability Analysis
The vulnerability resides in the Lifecycle Manager component of SailPoint IdentityIQ. When an authenticated user submits an access request for an entitlement whose value string contains leading or trailing whitespace, the application does not consistently normalize or validate the value before processing.
Because IdentityIQ compares, stores, and provisions entitlements based on string values, a whitespace-decorated value can be treated differently across code paths. Some layers may trim the value, while others preserve it verbatim. This inconsistency leads to a scope change in access decisions and can influence what the user ultimately receives or accesses beyond the initially authorized boundary.
The issue requires an authenticated session with permission to submit access requests, elevated attack complexity, and user interaction in the request workflow.
Root Cause
The root cause is improper input validation ([CWE-20]) in the entitlement value handling routines. IdentityIQ does not enforce canonical string normalization on entitlement values submitted through Lifecycle Manager access requests, allowing whitespace-decorated variants of legitimate entitlement identifiers to bypass expected value equality checks.
Attack Vector
Exploitation requires network access to the IdentityIQ web interface and an authenticated account with the ability to submit access requests. The attacker crafts an access request referencing an entitlement value with leading or trailing whitespace characters. The request then propagates through workflow, approval, and provisioning stages where inconsistent handling produces the security impact.
No verified public proof-of-concept code is available. See the SailPoint Security Advisory CVE-2024-1714 for vendor technical details.
Detection Methods for CVE-2024-1714
Indicators of Compromise
- Access request audit records where the entitlement value contains leading or trailing space, tab, or newline characters.
- Provisioning events where the granted entitlement value string does not exactly match a defined entitlement in the IdentityIQ catalog.
- Unexpected approvals or auto-provisioning for entitlements that would normally require additional workflow scrutiny.
Detection Strategies
- Review IdentityIQ audit logs for AccessRequest and IdentityRequest entries. Flag any entitlement value where value != trim(value).
- Correlate identity provisioning events with the IdentityIQ entitlement catalog and alert on values that do not match a normalized catalog entry.
- Baseline expected entitlement value formats per application and alert on deviations submitted by authenticated users.
Monitoring Recommendations
- Forward IdentityIQ audit and workflow logs to a centralized SIEM or data lake for continuous inspection.
- Monitor privileged group membership and application role assignments for changes that trace back to whitespace-affected access requests.
- Track access request submission patterns per user account to identify anomalous volume or repeated malformed entitlement values.
How to Mitigate CVE-2024-1714
Immediate Actions Required
- Apply the vendor-supplied patch for your IdentityIQ version as documented in the SailPoint Security Advisory CVE-2024-1714.
- Audit existing entitlement assignments for values containing leading or trailing whitespace and reconcile against the authoritative entitlement catalog.
- Restrict access request submission privileges to accounts that require them and require multi-factor authentication for IdentityIQ users.
Patch Information
SailPoint has issued fixes for supported IdentityIQ versions. Organizations running 8.1, 8.2, 8.3, or 8.4 should upgrade to the vendor-recommended patch level referenced in the advisory. Confirm the patch version deployed matches the fixed release documented by SailPoint for your major version.
Workarounds
- Add a custom Lifecycle Manager pre-processing rule that trims whitespace from entitlement values before workflow execution.
- Implement approver-side validation to reject access requests whose entitlement value does not exactly match a catalog entry.
- Increase manual review requirements for access requests that bypass automated approval paths until the patch is applied.
# Configuration example: search audit logs for whitespace-tainted entitlement values
grep -E 'entitlementValue="( +[^"]+|[^"]+ +)"' /opt/identityiq/logs/audit.log
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
